Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:32
General
-
Target
0a2a8452f3796c22a82d3720b0064fa9.exe
-
Size
158KB
-
MD5
0a2a8452f3796c22a82d3720b0064fa9
-
SHA1
10efc92389432a1e4205ffe7464fa48d20c54b75
-
SHA256
42ece1468a2eaac7f6e5a1d5de69249e561197d645c5192065226b760e524fbb
-
SHA512
b27572282d90644a4becc0118af6d04f4b864c6777b03e24349e2842be6e7b647c11162b91c773c89eb025df3eccfd33ee7548b519a102856f4e3826aa813828
-
SSDEEP
3072:6zc2FfZhN4rNGvjxnZzPRo8SZp67e6uDQi3rFWT5z2ZFsq/sVkU/MIWNbNYvtI:n25ZziSXt3Sb3DQi3rFW16Hb0kF
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a2a8452f3796c22a82d3720b0064fa9.exe"C:\Users\Admin\AppData\Local\Temp\0a2a8452f3796c22a82d3720b0064fa9.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
-
Filesize
4KB
-
Filesize
428KB